Google Workspace deployment

Deploy SafePrompt to every Chrome browser in your team in under 5 minutes from admin.google.com.

This guide is intended for Google Workspace administrators who need to roll out SafePrompt across their entire Chrome fleet. By the end, SafePrompt will be installed automatically on every targeted device and pre-configured with your tenant key — your users will not need to do anything.

Step 1 — Get your tenant_api_key

Sign in to the SafePrompt dashboard with your admin account. Your tenant_api_key and tenant_id are listed under Settings → Deployment. Copy both values — you will paste them into the policy file in the next step.

Step 2 — Download the policy file

Download the policy file below, open it in a text editor, and replace the two placeholders with the values collected in step 1. The final file weighs less than 1 KB.

google-workspace-policy.json
{
  "installation_mode": "force_installed",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "runtime_allowed_hosts": [
    "https://chatgpt.com",
    "https://claude.ai",
    "https://gemini.google.com",
    "https://chat.qwen.ai",
    "https://chat.deepseek.com",
    "https://openrouter.ai"
  ],
  "policy": {
    "tenant_api_key": "<TENANT_API_KEY>",
    "tenant_id": "<TENANT_UUID>"
  }
}

Download google-workspace-policy.json

Step 3 — Configure admin.google.com

Follow these steps in the Google Workspace Admin console to push the extension to your organizational unit.

  1. Open the Admin console

    Go to admin.google.com and sign in with your administrator account.

  2. Navigate to Devices → Chrome → Apps & extensions

    In the left menu, expand Devices then Chrome, and click "Apps & extensions". Select the "Users & browsers" tab.

  3. Pick the target organizational unit

    In the left column, click the organizational unit (OU) you want to deploy SafePrompt to — for example "Tech team", or the root OU if you target the whole organization.

  4. Add an extension by ID

    In the bottom-right corner, click the yellow "+" button and choose "Add Chrome app or extension by ID". Paste the SafePrompt extension ID provided by our team and confirm.

  5. Enable Force install

    In the right-hand panel that opens, under "Installation policy", pick "Force install". The extension will install silently and cannot be disabled by users.

  6. Paste the policy JSON

    Still in the right-hand panel, scroll down to "Policy for extensions" and paste the full content of google-workspace-policy.json (with your substituted values).

  7. Save

    Click "Save" in the top right. The policy is applied within 15 to 90 minutes depending on your Workspace setup; you can force the sync on a test device through chrome://policy.

Step 4 — Verify on a user device

On a target device (ideally already signed in to your Workspace domain), make sure the install went through.

  1. Open Chrome

    Launch Chrome on the user's device. Make sure the Chrome session is signed in with the user's Google Workspace account.

  2. Open the extensions page

    Type chrome://extensions in the address bar. Confirm that "SafePrompt" appears in the list with the "Installed by your administrator" badge.

  3. Check that the policy is applied

    Open chrome://policy in a new tab and look for the tenant_api_key and tenant_id entries. If they appear with your values, the deployment is complete.

Need help?

Our team answers enterprise deployment questions within one business day. Send a message to [email protected].

← Back to deployment guides